Verifies the 6-digit OTP for the given context:
signup — confirms the phone number is real. Returns { verified: true, phone }.
Call /auth-signup next to create the account.login — confirms identity and returns a full session with access and refresh tokens.